ansible

ansible/roles/forgejo/handlers/main.yaml

@@ -0,0 +1,5 @@
+---
+- name: Restart Forgejo
+  community.docker.docker_compose_v2:
+    project_src: /opt/forgejo
+    state: restarted

ansible/roles/forgejo/tasks/main.yaml

@@ -0,0 +1,39 @@
+---
+- name: Create Forgejo directories
+  file:
+    path: "{{ item }}"
+    state: directory
+    mode: '0755'
+  loop:
+    - /opt/forgejo
+    - /opt/forgejo/data
+    - /opt/forgejo/config
+
+- name: Deploy Forgejo app.ini configuration
+  template:
+    src: app.ini.j2
+    dest: /opt/forgejo/config/app.ini
+    mode: '0644'
+  notify: Restart Forgejo
+
+- name: Deploy Forgejo docker-compose
+  template:
+    src: docker-compose.yml.j2
+    dest: /opt/forgejo/docker-compose.yml
+    mode: '0644'
+  notify: Restart Forgejo
+
+- name: Start Forgejo
+  community.docker.docker_compose_v2:
+    project_src: /opt/forgejo
+    state: present
+  register: forgejo_output
+
+- name: Wait for Forgejo to be healthy
+  uri:
+    url: http://localhost:{{ forgejo_http_port }}/
+    status_code: 200
+  retries: 15
+  delay: 5
+  register: result
+  until: result.status == 200

ansible/roles/forgejo/templates/app.ini.j2

@@ -0,0 +1,83 @@
+APP_NAME = Gitea: Git with a cup of tea together with asxpi
+RUN_MODE = prod
+
+[server]
+PROTOCOL = http
+DOMAIN = {{ forgejo_domain }}
+ROOT_URL = https://{{ forgejo_domain }}/
+HTTP_PORT = 3000
+DISABLE_SSH = false
+SSH_DOMAIN = {{ forgejo_domain }}
+SSH_PORT = {{ forgejo_ssh_port }}
+SSH_LISTEN_PORT = 22
+START_SSH_SERVER = true
+LFS_START_SERVER = true
+OFFLINE_MODE = false
+
+[database]
+DB_TYPE = sqlite3
+PATH = /data/gitea/gitea.db
+LOG_SQL = false
+
+[repository]
+ROOT = /data/git/repositories
+SCRIPT_TYPE = bash
+DEFAULT_BRANCH = main
+DEFAULT_PRIVATE = private
+ENABLE_PUSH_CREATE_USER = true
+ENABLE_PUSH_CREATE_ORG = false
+DISABLED_REPO_UNITS =
+DEFAULT_REPO_UNITS = repo.code,repo.releases,repo.issues,repo.pulls,repo.wiki,repo.projects,repo.packages,repo.actions
+
+[ui]
+THEMES = forgejo-auto,forgejo-light,forgejo-dark,gitea-auto,gitea-light,gitea-dark
+DEFAULT_THEME = forgejo-auto
+
+[security]
+INSTALL_LOCK = true
+SECRET_KEY = {{ forgejo_secret_key | default('CHANGE-ME-PLEASE-GENERATE-NEW-SECRET') }}
+INTERNAL_TOKEN = {{ forgejo_internal_token | default('CHANGE-ME-PLEASE-GENERATE-NEW-TOKEN') }}
+PASSWORD_HASH_ALGO = pbkdf2
+
+[service]
+DISABLE_REGISTRATION = false
+REQUIRE_SIGNIN_VIEW = false
+REGISTER_EMAIL_CONFIRM = false
+ENABLE_NOTIFY_MAIL = false
+DEFAULT_KEEP_EMAIL_PRIVATE = true
+DEFAULT_ALLOW_CREATE_ORGANIZATION = true
+DEFAULT_ENABLE_TIMETRACKING = true
+NO_REPLY_ADDRESS = noreply.{{ forgejo_domain }}
+
+[oauth2]
+ENABLED = true
+JWT_SECRET = {{ forgejo_jwt_secret | default('CHANGE-ME-PLEASE-GENERATE-NEW-JWT-SECRET') }}
+
+[mailer]
+ENABLED = false
+
+[session]
+PROVIDER = file
+
+[log]
+MODE = console
+LEVEL = info
+ROOT_PATH = /data/gitea/log
+
+[actions]
+ENABLED = true
+DEFAULT_ACTIONS_URL = https://github.com
+ARTIFACT_RETENTION_DAYS = 365
+
+[repository.upload]
+ENABLED = true
+
+[repository.pull-request]
+DEFAULT_MERGE_STYLE = merge
+
+[repository.signing]
+DEFAULT_TRUST_MODEL = collaborator
+
+[lfs]
+PATH = /data/git/lfs
+LFS_JWT_SECRET = {{ forgejo_lfs_jwt_secret | default('CHANGE-ME-PLEASE-GENERATE-NEW-LFS-JWT-SECRET') }}

ansible/roles/forgejo/templates/docker-compose.yml.j2

@@ -0,0 +1,31 @@
+services:
+  forgejo:
+    image: codeberg.org/forgejo/forgejo:{{ forgejo_version }}
+    container_name: forgejo
+    restart: unless-stopped
+    environment:
+      - USER_UID=1000
+      - USER_GID=1000
+      - FORGEJO__database__DB_TYPE=sqlite3
+      - FORGEJO__database__PATH=/data/gitea/gitea.db
+    volumes:
+      - ./data:/data
+      - ./config/app.ini:/data/gitea/conf/app.ini
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      - "{{ forgejo_http_port }}:3000"
+      - "{{ forgejo_ssh_port }}:22"
+    networks:
+      - {{ traefik_network }}
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.forgejo.rule=Host(`{{ forgejo_domain }}`)"
+      - "traefik.http.routers.forgejo.entrypoints=websecure"
+      - "traefik.http.routers.forgejo.tls=true"
+      - "traefik.http.routers.forgejo.tls.certresolver=letsencrypt"
+      - "traefik.http.services.forgejo.loadbalancer.server.port=3000"
+
+networks:
+  {{ traefik_network }}:
+    external: true